General

  • Target

    4d5e6e4a571268d9aacaaff9eded34ad_JaffaCakes118

  • Size

    17.5MB

  • Sample

    240516-2mkqbscc29

  • MD5

    4d5e6e4a571268d9aacaaff9eded34ad

  • SHA1

    2054ce2b0e6ecd121c6510a65dd93f4131978e48

  • SHA256

    6ddf8848d96bfa5ec09d25b0b1deabf683940f455a166dc4440e4b758c6cf1eb

  • SHA512

    2354eac0d7e89e35a6867f00fdc5d757b8ae7f6aad7972f22659123c6f67ef5220ce579ffea94f66213c925f5f174c10763849165f839998adccc2c61843c879

  • SSDEEP

    393216:mt7pZl3EGLAyKwDDyn4zJ2ps/o6mJONTshFHo6r3ELG7P:qpZHSwTzJiIKiT25Tdz

Malware Config

Targets

    • Target

      4d5e6e4a571268d9aacaaff9eded34ad_JaffaCakes118

    • Size

      17.5MB

    • MD5

      4d5e6e4a571268d9aacaaff9eded34ad

    • SHA1

      2054ce2b0e6ecd121c6510a65dd93f4131978e48

    • SHA256

      6ddf8848d96bfa5ec09d25b0b1deabf683940f455a166dc4440e4b758c6cf1eb

    • SHA512

      2354eac0d7e89e35a6867f00fdc5d757b8ae7f6aad7972f22659123c6f67ef5220ce579ffea94f66213c925f5f174c10763849165f839998adccc2c61843c879

    • SSDEEP

      393216:mt7pZl3EGLAyKwDDyn4zJ2ps/o6mJONTshFHo6r3ELG7P:qpZHSwTzJiIKiT25Tdz

    Score
    7/10
    • Loads dropped DLL

    • Target

      $PLUGINSDIR/AdvSplash.dll

    • Size

      6KB

    • MD5

      13cc92f90a299f5b2b2f795d0d2e47dc

    • SHA1

      aa69ead8520876d232c6ed96021a4825e79f542f

    • SHA256

      eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb

    • SHA512

      ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3

    • SSDEEP

      96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP

    Score
    3/10
    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      325b008aec81e5aaa57096f05d4212b5

    • SHA1

      27a2d89747a20305b6518438eff5b9f57f7df5c3

    • SHA256

      c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    • SHA512

      18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

    • SSDEEP

      192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

    Score
    3/10
    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      9384f4007c492d4fa040924f31c00166

    • SHA1

      aba37faef30d7c445584c688a0b5638f5db31c7b

    • SHA256

      60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    • SHA512

      68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

    • SSDEEP

      48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2

    Score
    3/10
    • Target

      PBWS32.DLL

    • Size

      38KB

    • MD5

      410d09e8cd553a560386c5a76f265cf5

    • SHA1

      30488587ce89e56f21ea9da7d3b172d93decae0f

    • SHA256

      8e55f3ed041daf39b531b20f4607111f2175dea1ddcbb0645b07c5fc808ed240

    • SHA512

      029c06457ef5b41f75dd7640e8d8c9eb663b9e190d977e9dbccfc8ff5181dc0b9d39cf4d72b4defd6542f0c0890e775f2d4cf974a6074b5f5009d5e29729f3ba

    • SSDEEP

      768:pngliMfJPJ3qSGA+LPBVAx8Lb2AUCTMz2a7easJ:vm3hG5LPB+EU/zfyaw

    Score
    3/10
    • Target

      baro.exe

    • Size

      6.2MB

    • MD5

      e13333dbdac728e9b2055eb1a50c15bd

    • SHA1

      2f43b8ce29e2b7f752b3fa961142ca962005baae

    • SHA256

      8d3049266b99455df2e702e3328ce5b5c658622df78f788a5aa1ce01ccf0f2e4

    • SHA512

      8fe35286973f814c4319661866386297a927e2f4134b9f8fe04b7f353125a07c17b118f95739d86f78d06efc885253ef575d94c6dbee6c3b976536e82578c86f

    • SSDEEP

      49152:XAxE7wb02zj9roX+5Bw/IdF9I7UZTTkyeuBp1cJohA66DG:Xc/r19IfG

    Score
    1/10
    • Target

      dll/FreeImage.dll

    • Size

      3.2MB

    • MD5

      2513b9e999605cf8c42a8aa96837feae

    • SHA1

      76dde6500a044ba14547a648939ac11b1eaecc73

    • SHA256

      242d585b09c90708e5d626c01cfe0e474a2dec53b80e8d7aaa8a5a6b0b9f7323

    • SHA512

      0d876cb2ea35dc1a2c17adfe592bc2bb6e4075d3d86c39e3b1c0803e486fb5a90f9720c8565d936adff9b2f8bacf08276a9fe0054a1d673a62fb2be6774ae7e6

    • SSDEEP

      24576:71sXq+eR0/+qT8tLVMN8UasVK0dRk/IwBO24GXrkL84hDvJ4/RCZyCVf4Bxky1Jz:aBe8PAU7SEyhIGbIeT7SwF

    Score
    3/10
    • Target

      dll/Interop.WIA.dll

    • Size

      44KB

    • MD5

      858dd3d914c467b8c2326f015d927aca

    • SHA1

      48c836f62bcc9ec1c7dd7983c5bce9bec49c3db7

    • SHA256

      a9f47fa2b08f86fc7815c62321f71d727ff052288d01af09765ba5dd87f06ce0

    • SHA512

      cdaa609b8ae775a2c3b68415d368c51ef8cc67d9ed63e88a8613c809b4af8ac7975099f3f3941616b154065ecea60010ff90fc3cb92879711178abce0a4affc6

    • SSDEEP

      768:mvlrTN8xKiauFV1A1ZFWOmsQJ8m+N2wVZMc3jN2:Mlrp8NHmiBsQJ8m+MrAjE

    Score
    1/10
    • Target

      dll/PdfSharp.dll

    • Size

      568KB

    • MD5

      f9a4afed4a99e87450a359c3988c43d0

    • SHA1

      2a9082ca8b5276cb080c566277370680d48f78e7

    • SHA256

      6175d361837348f401db75f7c3f9ce541dd84ae015741feef8cc921398953176

    • SHA512

      b74b0a3149594fefb5e8972eb9baa3f953962fe9179de7db77d9915e9d7710612fc58b74d2296c64c9ad3033c7cc45e76d59fe32471a8ae0b4b309cd0017a600

    • SSDEEP

      12288:8GBiN8GPX1MfQlhbeyIVr1KWqVw/epCEbmgldA:851cQlhbp+D/epCEbmglG

    Score
    1/10
    • Target

      dll/RegAsm.exe

    • Size

      52KB

    • MD5

      4b63f5e28d8e2ed769cd900bf0709c22

    • SHA1

      8cdb6b0f735adf9ccf5cabd96df56edff72b287d

    • SHA256

      9e285994ac0c76f4b8b85878e9288972c512661c3ca089c23ec6713740510a36

    • SHA512

      cca29d8ffcb2829c23746b03d381c6cde5d44ceb96c99828ef73ec4f420ab239a641e7c3dd496ac75e65cb30b391ffd4a410f361e9b0d13b7715b48283a7bc22

    • SSDEEP

      768:L4P2Bbv+VazyoD2z9TU//1mz1+M9GnLEu+2ZWFRJS8j:/Jv46yoD2BTNz1+M9GLfew8j

    Score
    1/10
    • Target

      dll/SDD_TWAIN_SCANNER.dll

    • Size

      22KB

    • MD5

      95169eb3b1f580f7b75b74709648aab0

    • SHA1

      ab4dae1b43c3d1350112ae6413af83997a4c5f0e

    • SHA256

      d124c1827fcb11f398d1933a2619d6a7ce5c4344ff7fb9f9a4949ebfd9a33ece

    • SHA512

      8b9dce4d6e21f58f0ab62cbae260387be56ca95760390210595d6646465fbf94eb1854c9513c7ea040d15208cd953d38a2e1b33dc399a0a85826672c132613fb

    • SSDEEP

      384:GsMi7JRo7cYVW9b7L0DRIoO63l8BiPy2RM9HlGF4gKoeAWq:ANVkvL0DRIoO6eOA+Kosq

    Score
    1/10
    • Target

      dll/Saraff.Twain.dll

    • Size

      52KB

    • MD5

      dfd91064c061ee5a3245c936daee1d6a

    • SHA1

      29db79f7b45611d769467f4e063ef00feebe5073

    • SHA256

      2a92904383d482d5073fcbd9c2cbdc115c6fabd171a8173991c1992bdc01533a

    • SHA512

      e121b6b0320a15499d0befef6adf0ce678562cf3185451393f563bf9335f39ac222c1490d6057db1f83f9cca63cd8e7485e245a05bdfcb5235d570593a517448

    • SSDEEP

      1536:7SoLvyDjdUdQHUGSar8BrxvRC5RIt7Sz19:GUvyusBSRrx85g7Sz19

    Score
    1/10
    • Target

      dll/System.Drawing.dll

    • Size

      616KB

    • MD5

      3716fb11c20e313d2deb35e9a73a05f6

    • SHA1

      a26cecb78abc8f45913968bcd864a18f26ff165f

    • SHA256

      7b92496ac930d5f891654f3b4d3ecfa2751dbc86df314c1a141801d1ebfe8643

    • SHA512

      f0c7fd525e8a4d3642d9ff7b88b6081bc19126a92b3497de1ea1677416dbaeaa5b8e0be82d8344f0ac253f86d01ce66e10472b5ad654772c896871243ab503c7

    • SSDEEP

      6144:y/EoafvVBEQUIHx0lqYuRk5ydBZCpPSUC0ixkapt6i9SiSFqBywtlnISJHDEnChp:wafvVBDIQ6Knt6iHyqBPV5Rr9

    Score
    1/10
    • Target

      dll/UzakYardim.exe

    • Size

      740KB

    • MD5

      10a524d7ac94678ae286b065421647db

    • SHA1

      b538e3f113817c8237419310ef47817d1d961fa9

    • SHA256

      55daa062650d42e0feabc5ae1c3e4a7f68d4f8a3c69be375a0abc7bf3e1efad4

    • SHA512

      928b0e712e604a5ba9580ff6ecadbdf77e2fda6847b11366ce929281ae8e5e3a633073ff07176989ddcb5f8387c6f7c061729af99b61a23a319ddeb7d63ace1b

    • SSDEEP

      12288:pUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjmgvPi:ZpJJWOwlaUPcWWwRZb4Rt+N5WMasHDy

    Score
    10/10
    • FlawedAmmyy RAT

      Remote-access trojan based on leaked code for the Ammyy remote admin software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Target

      dll/WinSCP.com

    • Size

      286KB

    • MD5

      0317031c87b6626dffba1ee7572767d1

    • SHA1

      9fe90dbb9a65f87c48bd0448c786666b6577906e

    • SHA256

      83fab3dcef92514cf1f41ac458fb8b7dc5a93ac08cbf2d55d1c5989c66a27707

    • SHA512

      51125d3cbefc61c87949df26836da60f6716b9f36df1bfa56af63f1f7e20b386b60a0587233c56d05fc66eb206dbab46098dc4c3ad1681e622a7949b145f95c5

    • SSDEEP

      6144:SeoDiHHL7SIZaHBQuN67mUWyQsJwFqwckA/H9No:S5USIZahBN67mUW3AIA/c

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target

      dll/WinSCP.exe

    • Size

      9.7MB

    • MD5

      970f87e2a609b122a20667b5376a4847

    • SHA1

      4231757664a14a38ebbc4403f5c75230301f3db1

    • SHA256

      db21dfaf2a143fcb48d98456ecb215d67f6484961c94244741d88569c033f410

    • SHA512

      93a9900ba13fd8f5f87b5d0d3fba535c9fbaec1b73c8db831bb2dd02050438b960393f8cb0cbffefb582071f919dc3501bdd73fe1df33f36acf3322e23be28e9

    • SSDEEP

      196608:qsGchj5i2yHc+3D5a11Gv/8LBZHNa+Ra91Ojyft2SKdunyXvA8T28jGRI7i8Pw6E:q6TkJp4MKF8pqPrcH96+8ox7n9

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks

static1

ammyyadmin
Score
10/10

behavioral1

Score
7/10

behavioral2

Score
7/10

behavioral3

Score
3/10

behavioral4

Score
3/10

behavioral5

Score
3/10

behavioral6

Score
1/10

behavioral7

Score
3/10

behavioral8

Score
3/10

behavioral9

Score
1/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

flawedammyytrojan
Score
10/10

behavioral28

flawedammyytrojan
Score
10/10

behavioral29

Score
6/10

behavioral30

Score
7/10

behavioral31

Score
6/10

behavioral32

Score
7/10